API terms (summary)

Scope

These terms cover the Noccela Partner API (HTTP), the real-time WebSocket API, the Push API, the JavaScript SDK, sandbox access and this documentation. They apply to anyone who holds API credentials, whether as a customer, a partner, an integrator working for one, or an evaluator with sandbox access.

Credentials and confidentiality

• Credentials (client ID and client secret) are issued per app and are personal to your organisation. Do not share them with third parties other than contractors working on your behalf.
• Keep client secrets confidential: in your backend or a secrets store, never in browser code, mobile apps or public repositories.
• If a secret may have leaked, create a new one, delete the old one and tell us.
• Noccela may revoke or rotate credentials that are exposed or misused.
• Sandbox credentials are for evaluation and development, not for production use.

Acceptable use and rate limits

• Use the APIs only for sites that you, or the customer you work for, are entitled to access.
• Do not try to access other customers’ data, get around permissions, or re-identify people whose data has been pseudonymised.
• Do not resell raw location data or offer it as a service to third parties unless your agreement allows it.
• Do not run load tests or security tests against the APIs without written permission. Report vulnerabilities as described on our security page.
• To protect the service, Noccela may limit request rates and the number of concurrent connections. If your integration needs high volumes, agree the limits with us in advance.

Data and roles

• Location data about identifiable people is personal data. In most deployments the customer is the controller; when Noccela hosts the system, it processes data on the customer’s behalf under a data processing agreement.
• Integrators and partners who receive data through the APIs must have a lawful basis for their own processing, respect the purpose the customer defined, apply retention limits, and must not combine location data to profile individuals beyond that purpose.
• Tracking employees usually requires consultation with employees or their representatives before go-live. See privacy by design for people tracking.

Versioning and deprecation

• The current API version is listed in the changelog and in the OpenAPI description.
• Backward-compatible changes, such as new endpoints, new optional parameters and new response fields, can be made at any time. Build clients that ignore unknown fields.
• Noccela gives advance notice of breaking changes and of retiring an endpoint in the changelog. The notice period, and any direct notification, are set in your agreement.
• Server addresses for real-time connections can change: always look up the site’s node before connecting, as documented.

Availability and support

• Unless your agreement includes a service level agreement (SLA), the APIs are provided without guaranteed availability or response times.
• Planned maintenance may interrupt the APIs. Clients should reconnect and fetch missed data, as described in the documentation.
• Support is provided according to your agreement; contact support.

Not a safety-rated system

Noccela is a warning, alerting and awareness system. Positions, events and alerts delivered through the APIs can be delayed, missing or inaccurate, for example when a tag is shielded, a network is down or a battery is empty. Do not use the APIs as the only means of protecting people or property, and do not use them to control machine safety functions. Slowing or stopping a machine is the job of the machine builder or integrator, using safety-rated functions.

Intellectual property

The APIs, documentation and SDK remain the property of Noccela Oy. You may use the documentation and code examples to build integrations with Noccela systems. The SDK repository does not yet include a licence file; until it does, ask us before you redistribute the SDK. The Noccela name and logo may not be used to suggest endorsement without written permission.

Suspension and termination

Noccela may suspend access immediately in the case of misuse, a security risk or a breach of these terms or your agreement. Access ends when your agreement ends; what happens to stored data is set out in your agreement and data processing agreement.

Liability

The APIs and documentation are provided “as is”, except as your agreement states otherwise. To the extent permitted by law, Noccela is not liable for indirect or consequential loss, such as lost profit or lost data, and its total liability is limited as set out in your agreement.

Governing law

These terms and any dispute about them are governed by the laws of Finland, unless your agreement provides otherwise.

Changes to these terms

Noccela may update this summary. Material changes are announced in the changelog. The date at the bottom of this page shows the last update.

Contact

Questions about these terms: contact us. Security issues: security. Technical support: support.